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We introduce the problem of constructing weighted complex projective 2-designs 
from the union of a family of orthonormal bases. If the weight remains constant 
across elements of the same basis, then such designs can be interpreted as gener- 
alizations of complete sets of mutually unbiased bases, being equivalent whenever 
the design is composed of d + 1 bases in dimension d. We show that, for the pur- 
pose of quantum state determination, these designs specify an optimal collection of 
orthogonal measurements. Using highly nonlinear functions on abelian groups, we 
construct explicit examples from d + 2 orthonormal bases whenever d + 1 is a prime 
power, covering dimensions d = 6, 10, and 12, for example, where no complete sets 
of mutually unbiased bases have thus far been found. 



1. INTRODUCTION 

Fundamental to the fabrication of quantum information processing devices [lj, such as 
quantum teleporters, key distributers, doners, gates, and indeed, quantum computers, is 
the ability to precisely determine an unknown quantum state. Quality assurance requires a 
complete characterization of these devices, which can be accomplished through knowledge 
of the output states for a judicious choice of input states. 

The determination of an unknown state of a quantum system is achieved by a sequence of 
measurements on identically prepared copies of the system. If the outcome statistics for the 
measurements uniquely identify each member from the set of all quantum states, then an 
estimate of these statistics will reveal the particular state under examination. This process 
is called quantum state tomography (2)]. 

One method of tomography is to perform identical measurements on each system copy; 
in this case, complete state determination requires that the outcome statistics for this single 
repeated measurement be described by an informationally complete positive-operator- valued 
measure (IC-POVM) [l, H[. In the original tomographic paradigm jl, @, Q, II] , however, the 
measurements differ: each one is orthogonal and prescribed by a member of an informa- 
tionally complete set of quantum observables [si, [lO, [O, 12]. The standard example for this 



latter scenario is provided by a complete set of mutually unbiased bases (MUBs) |l3l . Il4 

D o\\d-l 
-j / fj=0 



That is, a maximal set of d + 1 orthonormal bases, {|e")}^ = o C C d , a — 0, ... ,d, having a 
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constant overlap of 1/d between elements of different bases: 



[e a 3 \e\)\ 2 




a = b: 
a 7^ b 



d = p n p^l, [15|, 116|, H7|, H8|, [19| 



There is current! 

22I, 0, H El, [2 



for their existence in other dimensions 
6, only sets of 3 MUBs have thus far been found 



In dimension 2, for example, the 3 bases correspond to "spin" measurements along the x, y, 
and z axes of the Bloch sphere. 

Explicit constructions of c omplet e sets of MUBs are known for all prime-power dimensions 

2(1 21 . There is currently no supporting evidence, however, 

27L Indeed, even in dimension 
HTIiirH, which falls well short of 
the 7 needed for the complete determination of a quantum state in this dimension. It is 
thus timely to search for alternative sets of bases that are also suitable for quantum state 
determination, but retain important properties of MUBs in this role. 

In this article we investigate weighted complex projective 2-designs that are formed by 
the union of a family of orthonormal bases. General complex projective i-designs and their 
variants have recently attracted attention from the perspective of quantum information 
theory @, |, EH, F 



33, 34, 35, 36, H3, 38, 39|. Within the context of quantum state 



determination, weighted 2-designs in CP that are formed by the union of a family of 
orthonormal bases for C d can be interpreted as generalizations of complete sets of MUBs, 
provided that the weight remains constant across elements of the same basis. In such cases, 
they specify a series of orthogonal measurements whose outcome statistics are together 
described by a tight IC-POVM The smallest number of bases that can be used to 
construct a weighted 2-design in CP d_1 is d + 1; when exactly d + 1 bases are used, these 
designs are equivalent to complete sets of MUBs. If an additional basis is allowed, however, 
we find that weighted 2-designs can be constructed from a family of d + 2 orthonormal 
bases whenever d+1 is a prime power, covering dimensions d = 6, 10, and 12, for example, 
where no complete sets of MUBs have thus far been found. Explicitly, in dimension 6, by 



appending the standard basis {|e°) 



to the 7 bases with elements 



3 i> 



1 5 



,2irijk/6 2ma3 k /7 



efc) 



7), 



;i.2) 



k=0 



we obtain a family of 8 orthonormal bases whose union forms a weighted complex projective 
2-design. All members of the standard basis are appointed the weight Wq = 1/42, while all 
members of the remaining bases are appointed the weight w a = 1/49. 

Most importantly, returning to the task of quantum state tomography, by measuring 
copies of a quantum system in the standard basis at a frequency ratio of 7 : 6 relative to 
each other basis, we retain the same minimal error rate in our estimate of the system state 
as that for a complete set of MUBs (if one were to be found). In fact, we show that families 
of orthonormal bases that form weighted complex projective 2-designs specify collections of 
orthogonal measurements which are (uniquely) optimal for quantum state tomography. 

The article is organized as follows. In the next section we give a precise definition of 
a weighted t-design in CP d_1 . In Sec. [3] we translate this notion to the class of t-designs 
formed by the union of a family of orthonormal bases, proving existence in every dimension, 
and then revealing equivalence to complete sets of MUBs in the special case of 2-designs 
constructed from d+1 bases. In Sec. @]we present new constructions of weighted 2-designs 



3 



in terms of highly nonlinear functions on abelian groups. In fact, constructions using only 
0(d 2 ) bases are shown to be sufficient, which can be reduced to d + 1 whenever d is a 
prime power (using a complete set of MUBs), or kd + 2 whenever kd + 1 is a prime power, 
for any positive integer k. We discuss weighted complex projective 2-designs in the role of 
state determination in Sec. El showing that such designs that are constructed from families 
of bases are optimal in this role in two specific scenarios: quantum state estimation as 
measurement-based cloning, and quantum state tomography by orthogonal measurements. 
Finally, in Sec. [6] we summarize our results. 



WEIGHTED COMPLEX PROJECTIVE t-DESIGNS 



The extension of spherical t-designs 40] to projective spaces was first considered by 



Neumaier 




but for the most part studied by Hoggar [42l . |43| . |44| . |45I |. and, Bannai and 



Hoggar [46|, |47|. For a unified treatment of designs in terms of metric spaces consult the work 
of Levenshtein 



MM 



(see also Ref.'s |51|, [52j, |53|, [54J, |55|, |56|, |57|, |58|). Our interest lies 
with the complex projective space CP d ~ l of lines passing through the origin in C d . In this 
case each x £ CP d_1 may be represented by a unit vector \x) £ C d (modulo a phase), or more 
appropriately, by the rank-one projector tc(x) := We will use both representations 

in this article. Roughly speaking, a complex projective t-design is then a finite subset of 
CP^ 1 with the property that the discrete average of a polynomial of degree t or less over 
the design equals the uniform average. Many equivalent definitions can be made in these 



terms (see e.g. Ref.'s [41], |42|. l48l. 1571 . l58l|). In the general context of compact metric spaces, 
for example, Levenshtein [49. |50j calls the pair (S>, w), where @ a finite subset of CP d 1 
and w is positive- valued function on <3) with the normalization J2 xe @w(x) = 1> a weighted 
t-design if 

w(x)w(y)f(\(x\y)\ 2 ) =11 dfi(x)dfi(y) f(\(x\y)\ 2 ) (2.1) 

J Jcp d - 1 



x,y£3> 



for any real polynomial / of degree t or less, where fi denotes the unique unitarily invariant 
probability measure on CP d_1 induced by the Haar measure on XJ(d). When w(x) = 
we recover the more common notion of an "unweighted" t-design. In the current context, 
however, it is appropriate to consider the more general notion, and then make an alternative 
explicit definition which is specialized to complex projective spaces. With this in mind, 
let LTsym denote the projector onto the totally symmetric subspace of (C d )®*, which has 
dimension and recall that 



dfj,(x) 7r(x 



d+i-l^- 1 T-r(t) 
sym 



(2.2) 



Since the LHS is invariant under all unitaries [7®*, which act irreducibly on the totally 
symmetric subspace of (C )®*, Eq. (12.21) follows from a straightforward application of Schur's 
Lemma. The following definition of a weighted t-design is now equivalent to the one given 
above (we will defer the proof until the end of this section). 

A countable set 5? endowed with a weight function w : — > (0, 1], normalized such that 



y 



W[X) 



1, will be called a weighted set and denoted by the pair (y,w). 
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Definition 2.1. A finite weighted set (@,w) 
dimension d) if 



C CP d 1 , is called a weighted t-design (of 



u>(a;)7r(a;) 



n6® 



/ sym 



(2.3) 



Seymour and Zaslavsky have shown that (unweighted) t-designs in CP d_1 exist for any t 
and d [13]. Notice that the normalization of w is already implied by the trace of Eq. (12.31) . If 
we instead "trace out" only one subsystem of these t-partite operators, we can immediately 
deduce that every weighted t-design is also a weighted (t — l)-design. A weighted 1-design is 
known as a tight frame in the context of frame theory [59j , in which case the unnormalized 
states \x) := \Jw(x)d \x) are the frame vectors, and Eq. (12.31) is the tight frame condition: 
Tlxe® = I- m this form it is immediately apparent that we must have \S>\ > d for 

a weighted 1-design, with equality only if the frame vectors \x) form an ortho normal basis 



for C d , i.e. w(x) = 1/d = and \{x 



5(x, y) for all i,!/ £ The 2-design case is 



treated in the following theorem (see e.g. Ref. [4j, Theorem 4] for a proof). 

Theorem 2.2. Let (@,w) be a weighted 2-design of dimension d. Then 
equality only if w(x) = and 



\(x\v)\' 



dS(x, y) + 1 
d+1 



> d 2 with 



(2.4) 



for all x, y 6 $1. 

Within the context of quantum information theory, a set of d 2 lines obeying Eq. (|2.4J) is 
called a symmetric IC-POVM (SIC-POVM) (see also Ref.'s 0, 0, 0, 0, 0, mM, 
64, [6^]). In general, the weighted complex projective 2-designs form a class of IC-POVMs 
which can be considered optimal in the role of state determination [4]. 

Theorem 12.21 is in fact a special case from known results within the theory of t-designs. 



In general, the number of design points must satisfy [42|, |46j, |48|, |51 



> 



d + \t/2] - 1 
\t/2] 



d + [t/2\ - 1 
[t/2j 



(2.5) 



with equality only if the design has uniform weight [481 ]. i.e. w(x) = A design 

which achieves this bound is called tight 1 . Tight t-designs in CP 1 are equivalent to tight 
spherical t- designs on the Euclidean 2-sphere. Such designs exist only for t = 1, 2, 3, 5 
(see e.g. Ref. [66 Q. When d > 3 it is known that tight t-designs in CP d_1 exist only for 



t = 1, 2, 3 [44J, |46j, |47| . It is trivial that tight 1-designs exist in all dimensions. Tight 2-designs 



are conjectured to also exist in all dimensions |3l . 1 3 lfl . A nal ytic al constructions, however, 
are known only for d < 10 and d = 12, 13, 19 [3|, |28j, [3l|, |60|, [6l|, [67 [. Tight 3-designs may 
exist only in even dimensions. Examples are known for d — 2,4,6 421 ] . Like in the specific 
2-design case, more can be said about the structure of the tight t-designs. Given their rarity 
for higher values of t, however, we will defer further results in this direction to the work of 
Bannai and Hoggar 42j, |43j, |44j, |45|, |46|, |47|. The task of finding t-designs is facilitated by 
the following theorem. 



The term "tight" is used differently in the contexts of frames and i-designs. A tight frame saturates the 
so-called frame bound [Eq. (|2.6|) with t — 1] whereas a tight i-design saturates Eq. (|2.5p . Tight i-designs, 
being 1-designs, are tight frames, but the converse need not be true. 
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Theorem 2.3. For any finite weighted set \w), 5? C CP 1 , and any t > 1, 

£ w(x)w(y)\(x\y)\ 2t > f^ 1 )" 1 , (2.6) 

with equality if and only if (J^, w) is a weighted t-design. 

Proof. Defining S := £ xgy ,w(x)tt(x) & - ( d+ J -1 ) _1 n^ we see that 

< tr(5+5) = £ ^MyJKrrly)! 2 *-^*- 1 )" 1 , (2.7) 

with equality if and only if S = 0, which is the defining property of a t-design. □ 

This theorem allows us to check whether a weighted set of points in CP d_1 forms a t- 
design by considering only the angles between the supposed design elements. It also shows 
that t-designs can be found numerically by parametrizing a weighted set and minimizing the 
LHS of Eq. (12. 6p . The lower bound is in fact a straightforward generalization of the Welch 
bound 68] (the above proof follows Ref. jH^j). We conclude this section by presenting two 
common alternative definitions of complex projective t-designs. The first was given at the 
outset [Eq. fl2~TD ]. 

Proposition 2.4. A finite weighted set (@,w), @ C CP^ 1 , is a weighted t-design if and 
only if 

£ w(x)w(y)f(\(x\y)\ 2 ) = [[ M*)Mv) f(\ (*\v) H ( 2 -§) 

JJcpd ~ 1 

for all polynomials f of degree t or less. 

Proof. Choosing the monomial f(u) = u l in Eq. (12. 8p and integrating the RHS we obtain 
equality in Eq. (12. 6p . Thus by Theorem 12. 3[ a finite weighted set (@,w) satisfying Eq. (12. 8p 
for f(u) = u l is a t-design. The converse is just as simple. By squaring both sides of Eq. (12. 3p 
and then taking the trace, we see that Eq. (12. 8p is satisfied by the monomial f(u) = u l when 
(^, w) is a t-design. The same is true for any monomial of degree less than t, since a t-design 
is also a (t — 1) -design, and thus by linearity, any polynomial of degree t or less. □ 

Let {|e 3 )}^~Q be the "standard" basis for C d . Define Hom(t, t) to be the set of polynomials 
which are homogeneous of degree t in the coordinates (ej\x) = xj on the unit sphere in C d , 
and also homogeneous of degree t in the conjugates of these coordinates, (x\ej) = Xj. For 
example, f(x) = (e \x)(x\ei) = x x.i is in Hom(l, 1). 

Proposition 2.5. A finite weighted set (&?,w), 3 C CP^ 1 , is a weighted t-design if and 
only if 

J2w(x)f(x) = [ Mx)f{x) (2.9) 
for all polynomials f G Hom(t, t). 

Proof. Simply note that Eq. (I2.9P for each monomial / G Hom(t, t) is given by a matrix 
component of Eq. (12. 3p in the standard basis. The monomials form a basis for Hom(t, t). □ 
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3. WEIGHTED ^-DESIGNS FROM BASES 

We now address the problem of constructing weighted 2-designs in CP d ~ l from the union 
of a family of orthonormal bases for C d . If the weight remains constant across elements of 
the same basis then such designs correspond to tight IC-POVMs j3] which can be realized 
by a sequence of orthogonal measurements. We will thus make this a requirement. 

To be precise, in the general case we seek a family of sets £% , . . . , £$ m -\ C CP d_1 , each 
specified by an orthonormal basis for C d , i.e. S$ a = {e®} d ~l where (e°|e£) = 8jk, and 
appointed a positive weight w a , such that their union 3 = U a ^ a forms a weighted t-design 
with the weight function w(x) = ^2 a w a l@ a (x). The set indicator function, 1a(x) '■= 1 if x G 
A and otherwise, takes care of any multiplicity in elements across different bases. Notice 
that the normalization of w(x) implies normalization of the basis weights: Yla w a = V^- 
Although we in fact have SS a C CP d_1 , we will refer to SS a as an "orthonormal basis for 
C d ," and then the line e" G CP^ 1 as the j-th element of the a-th basis. Revisiting Eq. (12. 3p 
shows that we require 

iTi — 1 d— 1 „ 

j2 w «T< e T = / M*)<*r = rrr'ngi, (3.1) 

or equivalently, by Theorem 12.31 

m— 1 d—1 

E K^>r = rrr 1 - (3-2) 

a, 6=0 J,fc=0 

Seymour and Zaslavsky j52[ have given a non-constructive proof that (unweighted) 
t-designs exist in every dimension. Their main result is quite general, and also applies 
to weighted t-designs constructed from bases: 

Theorem 3.1. Let Q be a path-connected topological space endowed with a measure u that 
is finite and positive with full support, and, let f : Q — >• R n be a continuous, integrable 
function. Then there exists a finite set C Q such that 

w\^ m ^^ki Mx)m - (3 - 3) 

The size of X may be any number, with a finite number of exceptions. 

Corollary 3.2. For each pair of positive integers t and d, and for all sufficiently large 
m, there exist weighted t-designs for CP d_1 which are formed by taking the union of m 
orthonormal bases for C d (as described above). 

Proof. Let Q = U(d) and u = fi, the Haar measure with n(U(d)) = 1. Applying Theorem 13. II 
to 

3 

which maps U(d) into End(C d )®* = M n , where n = 2d 2t and {ej} d ~Q is the standard basis, 
we know that for all sufficiently large m there exist sets X = {U a }™=i) C U(d) with the 
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property that [Eq. (13. 3p ] 

. (d+t-xy 1 n (t) 

\ t ) syi 



(git 



sym J 



(3.5) 



(3.6) 



using Schur's Lemma for the integral. Now setting |e") = t/ | e i) we have our desired result, 
i.e. Eq. (13. If) with w; a = 1/md. □ 



Our proof of Corollary [3^2] in fact shows that weighted t-designs formed by the unweighted 
union of orthonormal bases exist in all dimensions, i.e. we can take w a = 1/md. An example 



of a family of bases with this property is a complete set of mutually unbiased bases [13j, [14 



see also Ref.'s 15, hj, 17, 18, 19, 20, M 



orthonormal bases, 8§ n 



d-l 



&n&8$ b = {e h k } d - ] 
I(e?l4>| 2 



24|, [25|, [2J, |23, [28|, [29|, [30j, |33j). Two 



fc=0 , are called mutually unbiased if 

1 

d 



(3.7) 



for all < j, k < d — 1. A complete set of mutually unbiased bases (MUBs) is a set of 
m = d + 1 orthonormal bases with the property that each pair are mutually unbiased. This 
is the maximum possible number. Such sets are known to exist whenever d is a prime power, 
but no other examples have been found. It is straightforward to confirm [via Eq. (13.21) ] that 
a complete set of MUBs will form a 2-design when w a = 1/md [H, Our next result 
(which can be regarded as the analogue of Theorem I2.2l for the current case) shows that such 
sets are optimal, in that we always need m > d + 1 bases to construct a weighted 2-design, 
with equality only if the bases are mutually unbiased. 

Theorem 3.3. Let 8§o, ■ ■ ■ , 88 m -i C CP d_1 be a family of orthonormal bases for C d whose 
union *3i = U a 8S a forms a weighted 2-design with weight function w(x) = 2~2 a w o-^-^a( x ) f or 
some choice of the positive constants wq, . . . ,w m ^i. Then m > d + 1 with equality only if 
w a = 1/md for all a and the bases are pairwise mutually unbiased. 

Proof. Theorem 12 . 2 1 wit h \@\ = md immediately shows that we must have m > d, but since 
Eq. (12.41) can not be satisfied by a family of orthonormal bases, we in fact need m > d + 1. 
In the case of equality, note that by Theorem 12.31 we require [Eq. (13. 2p with t = 2} 



a aj^b j,k 



(3.8) 



where we have defined the positive numbers Xjk '■= |(e"|ey | 2 . Moreover, Theorem 12. 31 implies 
that the LHS of Eq. (13. 8p is minimal with respect to the variables w a and Xjk under the 
appropriate constraints, two of which are ^ a w a = 1/d and 



£K e il4>f 



tr(J-J) = d 



(3.9) 



We will now minimize the LHS of Eq. (13.81) under these two constraints. The minimum of 
V - k \ 2 j k subject to Eq. (13.91) occurs only when \j k = 1/d for all < j, k < d — 1, i.e., when 
83 a and 8§b are mutually unbiased. Then the LHS of Eq. (I3.8P reduces to 



1 

d* 



(3.10) 
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and here the minimum (under Yl a w a = V^) occurs only when w a = 1/md for all < a < 
m — 1. With this value, Eq. (13.101) reduces to the RHS of Eq. (I3.8P when m = d + 1. Equality 
in Eq. (13. 8p thus requires the bases to be pairwise mutually unbiased and w a = 1/md 
whenever m = d + 1. □ 

In general, for each positive integer t and d, we would like to know the quantity M(t, d), 
which we use to denote the minimum number of orthonormal bases needed to construct a 
weighted t-design in CP' 1 " 1 , or less ambitiously, bounds on this quantity. Trivially, M(l, d) = 
M(t, 1) = 1. Theorem 13.31 shows that M(2, d) > d + 1, with equality when d is a prime 
power. This theorem also shows that knowledge of M(2, d) in general would solve the MUBs 
problem, i.e., imply the existence (or most likely, nonexistence) of complete sets of MUBs 
in dimensions which are not prime powers. As we remarked earlier, no such examples have 
been found. For the first exceptional dimension however, d = 6, a tight 3-design exists 
which is formed from the unweighted (w a = 1/md) union of m = 21 bases. We thus know 
that 7 < M(2,6) < M(3, 6) = 21 (In fact M(3, d) = d(d + l)/2 when d = 2,4,6, the 
dimensions of the only known tight 3-designs). However, in the next section we show that, 
quite remarkably, M(2, 6) < 8, and moreover, M(2, d) < d + 2 whenever d + 1 is a prime 
power. 



4. WEIGHTED 2-DESIGNS FROM BASES: CONSTRUCTIONS 

In this section we give analytic constructions of weighted 2-designs using "highly non- 
linear functions" on abelian groups. Nonlinear functions on finite fields have been studied 
extensively in the context of classical cryptography, and several authors 6{J 7(J 7l|, 72] have 



extended those concepts to arbitrary finite abelian groups. Here we work with a class of 
functions called differentially 1-uniform, so named for their resistance to differential crypt- 
analysis [73| . 

Let G and H be abelian groups with \G\ < \H\ < oo, let / be a function from G to H, 
and consider the number of solutions in x to the equation 

f(x + a)-f(x) = b. (4.1) 

If (a, b) = (0,0) then Eq. (14. Xp has \G\ solutions. There are also \G\ solutions whenever / 
is linear or affine and b = f(a). A function is therefore highly nonlinear if Eq. (14.11) has as 
few solutions as possible for any choice of a and b. Of course we cannot avoid all solutions: 
letting b = f(x + a) — f(x) for any fixed x and a gives at least one solution. The function / 
is called differentially 1-uniform, or simply 1-uniform, if for every (a, b) ^ (0,0), Eq. (14. Xp 
has at most one solution [69(. 

By way of example, let Z n denote the cyclic abelian group of order n and define / : Z 5 — ► 
Z 6 through the following table. 



x 


12 3 4 


m 


10 2 2 



It is straightforward to verify that / is differentially 1-uniform. 

In constructing weighted 2-designs we will need the following characterization. 

Lemma 4.1. Let G and H be abelian groups. Then the function f : G — > H is differentially 
1-uniform if and only if the equation 

(w, f(w)) + (x, f(x)) = (y, f(y)) + (z, f(z)) (4.2) 
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has exactly \G\(2\G\ — 1) solutions in (w,x,y,z). 

Proof. Let d = \G\ and note that Eq. ( 14.2ft has d(2d— 1) trivial solutions, namely d solutions 
of the form (w,x,y,z) = (w,w,w,w) and 2(cP — d) solutions of the form (w,x,y,z) = 
(w, x, w, x) or (w, x, y, z) = (w, x, x, w) for x ^ w. Now rewriting Eq. ( 14. 2 j) in the form 

(«;,/(«;))-(«,/(«)) = (y,/(y)) -(*,/(*)) = (a,6) , (4.3) 

for some a and 6, we see that / is 1-uniform if and only if the solutions all satisfy w = z or 
w = y. That is, / is 1-uniform if and only if the only solutions are the trivial ones. □ 

We now come to our main construction. 

Theorem 4.2. Suppose there is a differentially 1-uniform function f : G — > H for the 
abelian groups G and H . Then there exists a weighted 1-design in CP' G ' _1 which is formed 
from the union of \H\ + 1 orthonormal bases for C' G '. 

Setting d = \G\ and m = \H\ + 1, it follows that M(2, d) < m whenever there exists a 
function / : G — > H which is differentially 1-uniform. The designs that Theorem 14.21 refers 
to are constructed as follows. We first assign the weight 

ro ° = 5(3TT) (44) 

to <5§?o := { e j}^=o> which is the standard basis for C d . All m—1 remaining bases are appointed 
the weight 

Wa = 7 TT77TTT ( a > °) » ( 4 - 5 ) 

[m — l)[d + 1) 

and then defined in terms of the characters of G and H. For a review of characters of finite 
abelian groups, consult Ref. Now for each j 6 G, let Xj De the j-th character of G, and 
similarly for each a G H , let ip a be the a-th character of H. The j-th element of basis SS a is 
then 

l e ?> := ^nY.xA^aif^))^) («>0), (4.6) 
^ d X& G 

using 0, . . . , d — 1 to denote the elements of G, but 1, . . . , m — 1 to denote the elements of 
H (with m — 1 now the additive identity), and the index always reserved for the standard 
basis in the latter context. The requirement (ej|e£) = 5jk now follows from the orthogonality 
of characters. 

Proof of Theorem \4-2\ Let d = \G\ and m = \H\ + 1. By Theorem 12.31 it suffices to show 
that 

£ ^ t £|<e«|4)r = (4.7) 

a,&e-ffU{0} j,k£G v y 

for the above weights [Eq.'s ( \AA\\ and (14. 5p ], and with SS a given by the standard basis when 
a = 0, i.e. |e°) = \ej), or defined by Eq. ( 14.61) otherwise. 

When a = b = 0, we have |(e°|e°)| 4 = | { e ^ | e ^ ) | 4 = Sjk- These terms contribute a total of 
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to the LHS of Eq. QSJ). When a = and b G H, we have |(e°|4)| 4 = |<ej|e|>| 4 = l/d 2 , and 
likewise for a G if and 6 = 0, adding a total of 

to the sum. 

For the remainder, we must evaluate |(e"|e^)| 4 for a,b £ H. First note that 

= 2T,*WMf( x ))Xk(x)rh,(f(x)) (4.10) 

x£G 

since the product of two characters, or the complex conjugate of a character, is another 
character. Multiplying by the conjugate, it follows that 

= J2 Xk-j(w + x-y-z)^ a (f(w) + f(x)-f(y)-f(z)). (4.13) 

w,x,y,z£G 

Now taking the sum over k G G and b E H, every character of G and H occurs once: 
d4 EK e il e ^| 4 = E E Xfc(« + x-y-z)^(/(«;) + /(x) -/(y) -/(«)) 

fceG fceG w,x,y,z£G 

beH b&H 

(4.14) 

= E ^Xw^^-zikWfw+fW-fw-fwib) (4.15) 

w,x,y,z£G fcsG 

= d 2 (m - l)(2d- 1) . (4.16) 

The last step is explained as follows. The inner summation in the RHS of Eq. (14. 15j) is zero 
unless both of the characters Xw+x-y-z and ipf( w )+f(x)-f( y )-f(z) are trivial, in which case the 
sum is \G\ ■ \H\ = dim — 1). But the characters are trivial exactly when w + x = y + z and 
f(w) + f{x) = f(y) + f(z). By Lemma H~Tj this occurs exactly d(2d — 1) times if and only if 
/ is 1-uniform. Thus Eq. (14.151) reduces to Eq. (14.161) . It follows that the total contribution 
to Eq. (14 .7p of terms with a, b G H is 

E E \m)\ 4 = (m _ 1) L +1)2 EEKsV fc )| 4 (4.17) 

a,b&H j,k£G V ; V ' j£G fcGG 

aeH beH 



1 v (m-l)(2d-l) 

(m- l) 2 (d+l) 2 ^ d? K ' ' 

2d -I . A , 

SRTTF ' (419) 
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Finally, adding up all contributions [Eq.'s (f£5)) . (Oil and (Q5I) ]. we find that Eq. fl47j) 
is satisfied, and so the union of the given bases forms a weighted 2-design. □ 

We now turn to the problem of constructing differentially 1-uniform functions. When 
/ : G — *■ H is 1-uniform, we always have \G\ < \H\; in terms of minimizing the number of 
bases in a 2-design, the goal is to minimize \H\. If \H\ — \G\ = d, then Theorem |4]2] produces 
a complete set of MUBs. Differentially 1-uniform functions / : G — > G are also called perfect 
nonlinear [7l[ or maximally nonlinear {72|, and they are known to exist whenever d is an 
odd prime power. In particular, let be the finite field of order d = p n . Then the function 
/ : Frf — > Frf is 1-uniform in the following cases [75| : 

1. f( X ) =X 2. 

2. f(x) = x pk+l , n/ gcd(n, k) odd ; 

3^ +1 

3. f(x) = x~^~ , p = 3, odd, gcd(n, fc) = 1 ; 



4. /(x) = x 10 — mx 6 — u 2 x 2 , p = 3, n odd, w G F^ 



where F^ is the multiplicative group of F^. The first example reproduces the MUBs of 



Ivanovic ^3| and Wootters and Fields \U 

When d is an even prime power, d = 2 n say, there are no 1-uniform functions from F^ to 
¥d- This is because in a field of characteristic 2, solutions to the equation f(x+a) —f(x) = b 
come in pairs {x, x + a}. However, there are 1-uniform functions from F^ to GR(4 n ), the 



Galois ring of order d 2 . For background on Galois rings, see Ref.'s 76| or [77|. Let T be the 



Teichmuller set of GR(4 n ), and for each x e F^ let x be the unique element of T such that 



x = x mod 2. Then fix) = x is 1-uniform [77|, and so there is a 2-design formed from the 



union of d 2 + l bases for C . In fact, all of the bases in this construction (except the standard 
basis) are repeated d times, which amounts to giving each distinct basis a larger weight. The 



result is the complete set of d + 1 MUBs described by Klappenecker and Rotteler [18 . 

When d is not a prime power, numerical evidence suggests that no complete set of MUBs 
exists. If this is true, then M(2, d) > d + 2 for those values of d. The following construction 
shows that M(2, d) < d + 2 whenever d + 1 is a prime power. 

Proposition 4.3. Let d+1 be a prime power, and let y be a generator for F^ +1 . Then the 
function f : 7L& — > F^ +1 defined by 

f(j) ■= V 3 (4.20) 

is differentially 1-uniform. 

Proof. Suppose Eq. ( 14. lft has two solutions for some a and b, say 

yi+*-yi = y k +--y k . (4.21) 

Factoring, we have 

(y>-y k )(y a -l) = 0, (4.22) 

which implies that either a = or j = k. So for (a, b) ^ (0,0), Eq. (14. ip has at most one 
solution. □ 
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The weighted 2-designs resulting from Proposition l4.3l are explicitly constructed according 
to Eq. (14. 6 p as follows. For j £ Z rf , the j-th character of the group Z d is Xj{k) '■= e 2m ^ k ' d ; 
for a £ Fd+i, the a-th character of F^ +1 is ift a { x ) := e 2nltT ^ ax ^ p , where d + 1 = p n (p prime) 

n — 1 m 

and tr x := x + x p + ■ ■ ■ + x p is the trace function from F^+i to F p . Thus if y is a primitive 
element of F^+i, then the j-th vector of basis SS a is 



d-l 

e «) := _Ly^ e 2Tijfc/d e a^tr(a»*)/ P | efc j _ ( 423 ) 
Vd ^ 



fc=0 



It remains to consider upper bounds on M(2, d) when neither d nor d + 1 is a prime 
power. In these cases, the following proposition shows that M(2, d) < kd + 2, where k is the 
smallest positive number such that kd + 1 is a prime power. The proof of Proposition 14.41 is 
the same as that of Proposition | 



Proposition 4.4. Let kd + 1 6e a prime power, and let y be an element of multiplicative 
order d in Fj-d+i- Then f(j) := yi is a differentially 1-uniform function from Z^ to Fj-d+i- 

The following table summarizes the resulting best known upper bound on M(2, d) for 
dimension <i < 50: 



d 


p 1 


14 


20 


21 


33 34 


35 


38 39 


44 45 


50 


M(2, d) < 


d + 1 d + 2 


30 


42 


44 


68 104 


72 


192 80 


90 182 


102 



A numerical search in dimension d = 14 was unable to locate an example of a weighted 
2-design composed of m < 30 orthonormal bases. The method used, however, which is an 
optimization procedure based on Theorem 12.31 is quite slow for such a large value of d and 
should not be trusted. 

In general, the upper limit for M(2, d) obtained from Proposition 14.41 is far from the lower 
bound of d+ 1. Linnik's theorem [78j gives an upper bound on the size of the smallest prime 
that occurs in the arithmetic progression (kd + 1)^: it implies that M(2, d) is 0(d L ), for 
some constant L. Heath-Brown [79j has shown that L < 5.5. However, the next construction 
shows that M(2, d) is 0{d 2 ). 

Proposition 4.5. Let f : — > Z n be the function f(j) := (Q, for < j < d — 1. If d > 2 
and n > j(d— l) 2 , then f is differentially 1-uniform. 

Proof. We work over the integers: let / : Z^ — > Z be the function that maps j to (^) , for 
< j < d—1. It then suffices to show that for every a £ {1, . . . , d— 1} and 6 £ {0, . . . , ra— 1}, 
the equation 

/(j + «) - /(i) = b mod n (4.24) 
has at most one solution. Fix a £ {1, . . . , d — 1}, and consider the differences 



if, , /PJ°)-(a). 3+a<d-l; 



(4.25) 



First examine the cases in which j + a < d—1. For these values of j, the differences 
C 2") — (2) are an distinct mod n. For, if (^ a ) — = ( t a ) — (J) mod ra, then simplifying 
we find that 

a(j - k) = mod ra, (4.26) 
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which holds only if j = k, since \a(j — k)\ < a(d — 1 — a) < \{d — l) 2 < n whenever 
n > \{d — l) 2 and < j, k < d — 1 — a. Similarly, the differences for which j + a > d are 
also distinct mod n for distinct values of j. 

We now show that no difference with j + a < d — 1 has the same value mod n as a 
difference with j + a > d. The largest value of the former occurs when j + a — d — 1, and 
the smallest of the latter occurs when j = d — 1 . So we require 



n > 

which simplifies to 



(V) - rr 1 )] - [(V) - ft 1 )] , (4-27) 

n > da- a 2 H - . (4.28) 

The largest value of the RHS of Eq. (I4.28P occurs at a = \_d/2\, which means the inequality 
is satisfied for all a whenever n > |(<i — l) 2 . Finally, the smallest difference with j + a < d— 1 
needs to be greater than the largest difference with j + a > d, i.e. — (°) > (°) — ft")' 
which is satisfied for all a whenever d > 2. □ 

It is also of some mathematical interest to construct weighted 2-designs in CP d_1 which 
are the union of m orthonormal bases for m larger than the minimum M(2, d). While these 
constructions are not so important in the context of quantum state tomography, they may 
be of use in other applications of designs. Moreover, insight into the general structure of 
such designs may eventually lead to improved bounds for M(2,d). Numerically, it becomes 
easier to find designs with m bases as m increases, and Corollary 13.21 and Proposition 14.51 
indicate that such designs will always exist for sufficiently large m. We now use differentially 
1-uniform functions to more precisely quantify "sufficiently large m" for certain values of d. 

There is very little literature on highly nonlinear functions / : G — > H with \G\ < \H\, 
as cryptographers have focused on the case \G\ > \H\. Nevertheless, 1-uniform functions 
become easier to find as \H\ increases. In fact, for fixed G, a random function / : G — > H 
is asymptotically almost surely 1-uniform as \H\ — > oo. There are also many recursive 
constructions. For example: if f\ : G — > Hi is any function and f2'-G^H 2 is 1-uniform, 
then the function f 1 + f 2 :G-^HixH 2 defined by 

(A + f2)(x) := (h(x),f 2 (x)) (4.29) 

is also 1-uniform. Embedding the codomain of a 1-uniform function into a larger group 
serves as a general strategy for constructing designs with many bases. 

Lemma 4.6. Let E : — > Z n be the function that maps (i mod k) to (i mod n), for 
< % < k — 1. // / : G — > Zfc is differentially 1-uniform andn > 2k — 1, then Eof;G^>7L n 
is also differentially 1-uniform. 

Proof. We again work over the integers. Let / : G — > Z be the function that maps x to the 
unique integer f(x) G {0, . . . , k — 1} such that f(x) = f\x) mod k. Since / is 1-uniform, it 
follows that for fixed a^O and b G Z, 

f{x + a) - f{x) = b (4.30) 

has at most one solution. Moreover, since fix) is in the range [0,k — 1], it is clear that 
fix + a) — f\x) is in [—k + 1, k — 1], a range of size 2k — 2. But n > 2k — 2, so it follows that 
fix + a) — fix) = b has at most one solution mod n. Thus E o f is 1-uniform as a function 
from G to Z„. □ 
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The proof of Lemma 14.61 also demonstrates that any cyclic subgroup in the codomain of 
a 1-uniform function can be embedded into a larger group. More precisely, suppose that 
fi : G — > Hi and f 2 : G — > are functions such that /i + /2 is 1-uniform from G to 
Hi x Zfc. Then for any n > 2k — I, the function /i + (Eof 2 ) is 1-uniform from G to Hi x Z n . 
But every group has some cyclic subgroup, so: if / : G — > H is 1-uniform, then for every 
n > 2|H| — 1, there a 1-uniform function g : G — > H' such that H' is a group of order n. 

Corollary 4.7. If f : G H is differentially 1-uniform, then for every m > 2\H\ there 
is weighted 2-design in CP' G ' _1 which is formed from the union of m orthonormal bases for 

Considering cyclic subgroups Z p in the codomains of perfect nonlinear functions or the 
1-uniform functions in Proposition 14.31 yields the following. 

Corollary 4.8. Suppose d = p n with p an odd prime, or d+ 1 = p n with p any prime. Then 
for every m > d + p + 1, there is a weighted 2-design in CP d_1 which is formed from the 
union of m orthonormal bases for C d . 



5. WEIGHTED 2-DESIGNS AS INFORMATION ALLY COMPLETE POVMS 



The outcome statistics of a quantum measurement are described by a positive-operator- 
valued measure (POVM) j80| on a set S£ of measurement outcomes. When J?T is countable 
the POVM is completely characterized by a set of positive operators, {F(x)} xe %-, called the 
"POVM elements," which together satisfy the normalization constraint Ylxesr F{x) = I. An 
informational^ complete POVM (IC-POVM) 0, |, |, llOl . I 111 . [12[ is one with the property 



that for each quantum state, p G Q(C d ) := {A G End(C d ) | A > , tr(A) = l}, the outcome 
statistics, p(x) := tv[F(x)p\, uniquely identify the state. A sequence of measurements on 
copies of a system in an unknown state, enabling an estimate of the statistics, will then 
reveal the state. 

In this article we are dealing primarily with rank-one POVMs. It is then appropriate to 
consider the measurement outcomes as points in complex projective space, 3C C CP d_1 , 
and set F{x) = t(x)tt(x), where n(x) := |a;)(a:| and the positive weights r(x) inherit the 
normalization YlxeT T ( x ) = d- Important examples of such IC-POVMs include symmetric 
IC-POVMs (SIC-POVMs) [30 and complete sets of mutually unbiased bases (MUBs) [H, [l4 . 
The main purpose of this section is to show that weighted complex projective 2-designs of the 
type constructed in the previous section, which include complete sets of MUBs as examples, 
specify optimal IC-POVMs for quantum state tomography by orthogonal measurements. 
This will be done in Sec. 15.31 We will begin by revisiting some of the results of Ref. [4|. 

It is clear that weighted 1-designs are equivalent to rank-one POVMs under the associa- 
tion t(x) = w(x)d and 3C — @. Weighted 2-designs have the additional property of being 
informationally complete. A productive way of showing this is as follows. Equipped with 
the Hilbert-Schmidt inner product (A\B) := tr(A^H), the vector space End(C d ) = C d2 is an 
inner product space where we think of (A\ as an operator "bra" and \B) as an operator "ket" 
(see Caves j8l| or Ref. [H for notational clarification). Addition and scalar multiplication of 
operator kets then follows that for operators, e.g. \aA + bB) = a\A) +b\B) for a, b G C. Un- 
der the identification A® B^ \A)(B\ we can rewrite our definition of a weighted 2-design 
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[Eq. ([2l| with t = 2 and w(x) = r(x)/d] 

r(2) 



2IT j If \ 

J2r(x)7r(x)^7r(x) = j^- = —l \ ej ){e k \ ® |e fc )(e,| + / ® i) , (5.1) 

™cCi Not. / 



in superoperator notation as 



J2r(x)\n(x))(n(x)\ = = ^-(X) H e i>< e *l)(l e i>< e *H + l J )( J l) ■ ( 5 ' 2 ) 

ief ^ j,k ' 

where I := Y2j k \ \ e j)( e k\) (l e i)( e fc| | is the identity superoperator under the "left-right" ac- 
tion jsH (meaning superoperators act on operators just like operators on vectors), i.e. 
1\A) = \A) for all A G End(C d ). The informational completeness of {F(x) = t(x)it(x)} x( z@ 
is now immediately apparent from Eq. (I5.2p . In fact, an explicit state- reconstruction formula 
follows from the left-right action of this equation on a quantum state: 

ETW |^)) ( , W |,) = M+MCM = !4±a ( 5.3) 

x£S> 

which simplifies to 

p = (d+l)X>(zMz) " I, (5-4) 

where p(x) '.= ti[F(x)p] = t(x) tr[7r(x)p] are the measurement outcome statistics. 

The map tt embeds complex projective space into End(C d ). If we instead embed CP^ 1 
into the real vector space of traceless Hermitian operators Ho(C d ) := {A G End(C d ) | A^ = 
A, tv(A) = 0} = M^" 1 , via the mapping x -> &(x) := tc(x) - I/d, then Eq. (15T21 takes a 
revealing form. Recalling the normalization Ylxe%> T ( x ) = ^> we can rewrite this equation as 

J2<x)\n(x)-I/d)(n(x)-I/d\ = 1 ~^ ,d = (5.5) 

where IIo := I — \ T){I\/d is the projector onto the subspace of traceless operators in End(C d ). 
In H (C d ), this of course means 

J2r(x)\$(x)){$(x)\ = ij-, (5.6) 



ief 



where I Hq denotes the identity superoperator for this space. The interpretation afforded by 
Eq. (15. 6p . which states that {^{x)} x( zs> forms a tight (operator) frame [59] in H (C d ) with 
respect to the "trace" measure r, is that rank-one IC-POVMs which correspond to weighted 
2-desiens in CP close as possible" [82|, [83[ to orthonormal bases for Ho(C d ), when 



embedded into this space. Weighted complex projective 2-designs have thus been called 
tight rank-one IC-POVMs |4|. This analogy with tight frames is particularly pleasing since 
under the projection \p) — > n |p) = \p — I/d), H (C d ) is the natural place to study a general 
quantum state p G Q(C d ). Indeed, Q(C 2 ) then corresponds to the Bloch sphere. 
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5.1. Optimal quantum state estimation 

Not only do tight rank-one IC-POVMs possess the above elegant structure, they are the 
optimal choice in the following state-estimation scenario. Consider a measuring instrument 



in the role of a cloning machine [84], |85|, |86j, |87|, |88| (i.e. a one-to-infinity doner [89(). The 



input to this machine is a single copy of an unknown pure state, ■0, and the output, p(x) 
is a state chosen to estimate ip based on a measurement (with outcome x). The fidelity 
between the input and output states, averaged over the measurement outcomes, 

/(*«(V0 := ^tr[F(ar)7r(^)]tr[p(x)7r(^)] , (5.7) 

can then be optimized for a worst-case input, only when the measurement is described by a 
tight IC-POVM (see Ref.'s 0,0). More precisely, 

■= , inf t f im W < "7~~T , (5-8) 

with equality if and only if the outcome statistics for the measurement are described by a 
tight rank-one IC-POVM, {F(x) = t(x)it(x)} x€ , x - where 3£ C CP d_1 , and p(x) = ir(x) is 
chosen for the output state. In such cases the output fidelity is in fact independent of the 
input state: f {F >P\ip) = 2/(d + 1). 

A measurement in a random basis is one strategy to achieve equality in Eq. (15.81) . However 
a measuring instrument configurable to only m different bases, 3§ , . . . , & m -i, will also 
suffice, provided S> = U a £$ a forms a weighted 2-design with weight w(x) = Y^ a w a^^a( x )i 
and the a-th basis is chosen with probability v a = w a d. This follows from the straightforward 
fact that rolling an m-sided die, where the a-th side occurs with probability v a , and then 
performing an orthogonal measurement in a basis corresponding to the result, &B\, say, is 
one way of realizing the POVM \F[x) = t(x)7t(x)} x( z%- with E£ = U a 3$ a and r(x) = 
Yla v aXss a k x \ When d is prime power we know that only m — d + 1 configurations for 
the orthogonal measurements are needed, each specified by a member of a complete set of 
MUBs. If d is not a prime power, but d + 1 is, then the constructions of weighted 2-designs 
in the previous section show that m = d + 2 configurations suffice. In general, M(2, d) 
configurations are sufficient and necessary under a restriction to orthogonal measurements. 



5.2. Optimal quantum state tomography by a repeated general measurement 

Tight rank-one IC-POVMs are also an outstanding choice for quantum state tomogra- 
phy [2j. Suppose that we are instead given iV copies of a system in an unknown general 
quantum state p G Q(C d ). A sequence of measurements on these copies, each with a measur- 
ing instrument described by the same IC-POVM, {F(x)} x€f %- say, will provide an estimate 
of the statistics p(x) = tr[F(x)p], and hence, identify the state. 

State reconstruction for a general IC-POVM is facilitated by a dual frame [59] to the frame 
of POVM elements {F(x)} x< z%-, i.e. a set of operators {Q(x)} x< z%- C End(C d ) satisfying 

^2\Q(x))(F(x)\ = ^2t(x)\Q{x)){P(x)\ = I, (5.9) 

J.-6 
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where we have introduced the positive-operator-valued density (POVD) P(x) := F(x)/t(x) 
and t(x) := tr[F(x)] for a general POVM. Alternatively, Q is a dual frame to P with respect 
to the trace measure r. In the current context we will refer to Q as a reconstruction operator- 
valued density (OVD) for the IC-POVM F . The left-right action of the dual frame condition 
[Eq. (15. 9p ] on a quantum state \p) provides a state-reconstruction formula: 

P = ^2p(x)Q(x) . (5.10) 

There are generally many different choices for Q. The canonical dual frame to P (with 
respect to r), 

\R{xj) := F- l \P{x)) , (5.11) 
is found through the (left-right) inverse of the POVM superoperator, 

T := ^2r(x)\P(x))(P(x)\ . (5.12) 

x^X 

It is straightforward to confirm that T~ l exists if and only if the POVM is informationally 
complete, and that Eq. (15.91) is satisfied for Q = R. The optimality of this choice was 
established in Ref. [1] for the current setting and then again by D'Ariano and Perinotti [§(| 
for a similar scenario. In the special case of a tight rank-one IC-POVM, in which case 
F(x) = t(x)ii(x) and =5T C CP d_1 , the canonical dual is R[x) = (d + l)n(x) — /, and 
Eq. f^TUjl reduces to Eq. (IO> . 

Now returning to our problem of state reconstruction, if y 1 , . . . ,y N G 9£ are the mea- 
surement results, then one estimate for the statistics is simply 



1 N 

p(x) = p(x;y!,...,y N ) := — S(x, y k ) , (5.13) 



k=l 



which under Eq. (15.101) gives 

P = p(yh---,VN) ■= ^2p(x;yu... } y N )Q(x) , (5.14) 



for an estimate of p. We will call p a linear tomographic estimate of p to distinguish it from 



more sophisticated choices, such as those from maximum likelihood estimation [9ll . 192 



Bayesian mean estimation [93, [94j, [95|, [96|, 197 



or 



The Hilbert-Schmidt distance dus(p, p) '■= \\p — p\\, where \\A\\ := y/(A\A}, provides a 
measure of the expected error in our estimate: 

e^\p) := E [||p-p(yi,...,y*)|| 2 l • (5.15) 

Let p = p(a, U) := UaU^ for some fixed quantum state a G Q(C d ). It has been shown that, 
for random Hilbert-space orientations U between the state a and measuring apparatus, the 
average Hilbert-Schmidt error can be minimized only when {F{x)} x& $; is a tight IC-POVM 
(see Ref. 0, Theorem 18]). That is, 

4v Q) (°") := / d^U)e {F ' Q \p(a,U)) > ±Ud+l) -l-tr(a 2 )) , (5.16) 
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with equality if and only if the outcome statistics for the measurements are described by a 
tight rank-one IC-POVM, {F(x) = t(x)tt(x)} x ^ where % C CP d -\ and Q(x) = R(x) = 
(d + l)n(x) — I is chosen for the dual frame. The same is true for the worst-case error 
e^c®\(y) '■= su Pc/eu((i) e <yF,Q \p{a, U)), and in fact, tight rank-one IC-POVMs form the unique 
class of POVMs achieving 

e™(a) = e£ R \a) = e^(p(a,U)) = ^(d(d+l) - 1 - tr(a 2 )) . (5.17) 

These results show that if we treat a family of m bases . . . , «5^ m _i, as a single rank- 
one IC-POVM, {F(x) = T(x)ir(x)} xe & say, by setting 3£ = U a ^ a and r(x) = Y.a v a 1 ^ a ( x ) 
for some choice of weights v a , then the error in the tomographic process is minimized if 
and only if the outcome set 3£ forms a weighted 2-design with weight w(x) = r(x)/d, and 
Eq. (15.41) is used for state reconstruction. As we remarked in Sec. 15.11 one way of realizing 
the IC-POVM is to perform random orthogonal measurements as specified by the bases. In 
this case basis SS a is chosen with probability v a . Smaller error rates are achieved, however, 
if we instead choose SS a exactly v a N times. The following subsection focuses on this latter 
scenario. 



5.3. Optimal quantum state tomography by a series of orthogonal measurements 

When quantum state tomography is achieved through a series of orthogonal measure- 
ments, each specified by a member of a complete set of MUBs, it is customary to cycle 
through the bases in turn rather than select them randomly with equal probability. We will 
now treat this important scenario for a weighted complex projective 2-design composed of m 
orthonormal bases, = U a & a . Although our results will apply in the general case, where 
there might be a multiplicity in elements across different bases, for the sake of notational 
simplicity, we will assume in this subsection that this is not the case. That is, we will assume 
that \3£\ = md, so that io(e") = w a (or r(e|) = v a ) under the association £$ a = {e"}^~Q. 

For complete state determination we require that the bases are in fact eigenbases, pre- 
scribed by members of an informationally complete set of quantum observables [§, HoL [Til. fl2| . 
Alternatively, the bases must together form a rank-one IC-POVM, {^(e") = u a 7r(e")} OJ -, for 
some choice of the positive weights v a . We prefer this latter setting since state reconstruction 
now follows from the results of Sec. 15.21 Note that if the POVM is informationally complete 
for one choice of the weights, then it is informationally complete for all choices. Thus, with 
the exception that v a > and ^2 a v a = 1, the weights can be chosen arbitrarily. There will 
be one particular choice, however, which will ease the analysis. With these considerations 
in mind, let us now begin. 

Suppose that we make a series of orthogonal measurements as specified by a family of 
bases & , . . . ,3& m -i, which together form a rank-one IC-POVM, {F{e^) = t> a 7r(e")} a j, for 
some choice of the weights v a > 0. Let n a denote the number of measurements in basis 3§ a , 
and let := n a be the total number of measurements. Since we know that the IC-POVM 
in fact describes a series of orthogonal measurements, we will replace our previous estimate 
of the statistics [Eq. f)5.13p ] with 



N 

P(e^) = p(e<*; yi ,...,y N ) := ^ ^ 5(el y k ) , (5.18) 



k=l 
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but retain Eq. (15.141) for our estimate of p. Now following Ref. 0], we use this equation and 
Eq. (I5.10p together to rewrite the squared Hilbert- Schmidt distance as 



Wp-pW 



E (p(x) - P(x)) (p(y) - p(y)) (Q(x)\Q(y)) 



E W e i) -P(e"))(p(4) -P(el))(Q(e])\Q(e b k )) 

a,b,j,k 



(5.19) 
(5.20) 



giving an error in the form 

e ({.^a,M,Q)(p) ; : 



E 

Vlr-iVN 



\\p- p(yi,---,yN)\\' 



(5.21) 
(5.22) 



a,j,k 



since 



E 

Vi,—,Vn 



(p(e1)-p(e«))(p(e h k )-p(e b k )) 



v a v b E 

Vl,—tVN 



(5.23) 
(5.24) 



^(n,/^;;vv-/^;;Mo; 

"-a 



(5.25) 



where g(e") := tr[7r(e")p] = p(ej)/v a is the probability of result e" for the a-th orthogonal 
measurement, our estimate for this probability is g(e") := p{e^)/v a [under Eq. ( 15. 181) ] . and 
the expectation is an elementary calculation. 

Now suppose that the rank-one IC-POVM {F(e") = v a 7i(ej)} a ,j is in fact a tight IC- 
POVM. Choosing n a = v a N and Q(ef) = R{ef) = (d + l)ic(e$) - I for the dual frame, we 
find that Eq. (j5.22j) simplifies to 



But for a tight rank-one IC-POVM 

>p P{^) 2 = 

a,3 



(d+lf 
N 



1 ^p(tf) 2 



a. j 



(5.26) 



E'«atr [Tr(e^) ®Tz{ef) ■ p ® p] 



<>:) 



^(i + tV)), 



(2 + 



using Eq. ( 15. If) with r(e") = t> a , achieving the error rate 



(5.27) 

(5.28) 
(5.29) 



(P) 



d + 1 

N 



d - tr(p 2 ) . 



(5.30) 
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Although the dominating contribution of d 2 /N remains the same, a comparison of the two 
error rates confirms a small improvement: 

< e W«)(p)- e «*-.M,fl)(p) = _L(^tr(p 2 )-l) < ^i. (5.31) 

The difference can be attributed to Eq. ( 15.221) (as compared to Eq. (76) of Ref. 0]), which 
takes into account that the bases are now being chosen nonrandomly. 

We will now show that the improved error rate [Eq. (I5.30p ] is in fact the minimum 
possible for any family of bases &o,...,& m -i, and for any choice of the reconstruction 
OVD {Q(ej)} a ,j, i.e., for any Q satisfying the dual frame condition 

^|Q(e«))(F(e?)| = 5>„|Q(e«)) (P(e«) | = I, (5.32) 

a,j a,j 

where P{ef) = vr(e^). Let p(a,U) := UaW for some fixed quantum state a G Q(C d ) and 
define the average error in the linear tomographic estimate of p(er, U) as 

e «*a.*»}.<J)( <7 ) := f dn(U) e^' Va} ' Q \p(a,U)) , (5.33) 

JV(d) 

using Eq.'s (15. 101) . (15.141) . (I5.18P and (15.211) . The following is then the main result of this 
section. 

Theorem 5.1. Let 3§o, . . . , £$ m -\ C <CP d ~ l be a family of orthonormal bases for C d with the 
property that {F{e a j) = f a 7r(e")} a j is an IC-POVM, under the association SS a = {e|}^=o, 
for some choice of the positive constants Vq, . . . ,f m _i. Then for any fixed quantum state 
a G Q(C d ) ; the average error in the linear tomographic estimate of p(o~, U) after N = n a 
orthogonal measurements, with n a > of those measurements in the basis SS a , satisfies 

elf^^V) > ^±i(d-tr(a 2 )), (5.34) 

for all reconstruction OVDs {Q(e")} a j. Furthermore, equality occurs if and only i/{F(e") = 
v a K { e f)}a,j is a tight rank-one IC-POVM for the choice v a = n a /N, and, assuming this choice 
for state reconstruction, Q(e°j) = (d + l)7r(e|) — I + D a , where {D a } a is any set of operators 
satisfying Yj a v o, D a = 0. 

In particular, equality holds in Eq. (15.341) for a tight rank-one IC-POVM whenever Q is 
the canonical dual frame, namely Q(e°j) = R(ef) — (d + l)7r(e") — I. 

This theorem is the analogue of Theorem 18 in Ref. j3] and its proof will be similar. We 
first establish that the canonical dual frame with respect to the trace measure is optimal 
for state reconstruction. Unlike the scenario considered in the previous subsection, however, 
where the bases were sampled randomly, the canonical dual is no longer the unique optimum. 
These facts are a consequence of the following lemma (which is analogous to Lemma 16 of 
Ref. Recall the general definition of the canonical dual frame R [Eq. (15. lip ]. 

Lemma 5.2. Let {F(e°j) = v a Tc(ej)} ai j be an IC-POVM with reconstruction OVD {<5(e")} a j, 
where each SS a = {e"}^~g is an orthonormal basis for C d . Then 

^^(^-^)(g(e J a )|Q(e^)) > J2va(5 jk -l)(R(e«)\R(et)) , (5.35) 
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with equality if and only ifQ(e%) = R(e%)+D a , where {D a } a is any set of operators satisfying 

Proof. By analogy with the dual frame condition [Eq. (15.321) ] . first note that 

X>.|Q(e?))(P(eS)| = 52va\Qtf))(l\ = , (5-36) 

a,j,k a,j 

since J2k P( e fc) = T^k^^V) = I an d the left-right action of Eq. ( 15.321) on \I) shows that 
S a j v aQ( e °j) — I- Now Q and R are both dual frames, so defining D := Q — i? we have 

5> a |D(eJ))(P(ejE)| = - |J)(/| = 0, (5.37) 

and since |i2(eg)) := J 7-1 ^^)), 

^« a |i?(eJ))(i2(eJ)| = 0, (5.38) 

which means 

$>.(l>(e$)|J2(e2)) = 0. (5.39) 

This is the analogue of Eq. (89) in the proof of Lemma 16, Ref. [4J, which in the current 
scenario takes the form 

Y,v a (D(e^\R(e])) = 0. (5.40) 

a,j 

Combining, we obtain 

a,j,k 

Using this relation and the inequality 

^£v a (8 jk -~)(D(e«)\D(e a k )) = £«a(C(e?)|C-(e?)) * °> ( 5 - 42 ) 

a,j,k a,j 

where we have set C(e") := -D(e") — \ 12k^( e t)i we obtain 

+ (D(e«)\R(e a k )) + (D(e«)\D(e a k ))] (5.43) 
= 5> a (X* - [(P( ej a )|P^)) + (I?(e?)|£>(ej))^ 

a J, A; 

(5.44) 

> ^^(^-^)(P(ef)|P(ea , (5.45) 

a,j,k 

which is our desired result. Equality holds if and only if C(e") = for all j and a, or 
equivalently, D(e°j) = D a , an operator which is independent of j. Both R(e%) and Q(efy = 
R(el) + D a must remain dual frames, however, so it is necessary that Ylaj v a\P{ e °j)) [Pa\ = 
J2 a v a \l){D a \=0,i.e.J2 a v a D a = 0. □ 
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The following technical result is also needed to prove Theorem 15 .11 Let T := £V k \ej) (e^j 
|efc)(ej|, which is called the "swap" since T\ip) ® |0) = |0) ® |-0). 

Lemma 5.3. Lei /i 6e t/ie i/aar measure on \](d). Then 



U(d) 



Proof. We have previously seen that [Eq. (12.21) ] 
which is Eq. (15.461) for j = k. Now write / = ^ . 7r(ej) and expand 



d//(C7) [£OT f ] (8) [Z7JZ7+] 



U(d) 

j,k 

d/i{U) (d [Unie^]® 2 + d{d - 1) [C/tt^)^] ® [Eftr^)^] 

U(d) v 

I® J + T 



d + 



^L + d{d-l) [ dp{U) [UTi{e 3 )U ] ] <g> [Un(e k )rf] 

1 JV{d) 



(5.46) 
(5.47) 

(5.48) 
(5.49) 

(5.50) 
(5.51) 



assuming j ^ k in the last two lines. Solving this equation gives Eq. (15.461) for j ^ k. □ 

Proof of Theorem \5.1\ First note that since the weights v a could always be absorbed into Q 
in the RHS of Eq. (I5.32p . we are free to set v a = n a /N without any loss of generality, and 
thus do so. Now using Eq. ( 15.221) we have 



dfx(U) e^' v ^' Q \p{a, U)) 



(5.52) 



U(d) 

f MU) Y^-{v aP (e^ jk - P(e a 3 )p(e a k )) {Q(e a 3 )\Q(e a k )) 



(5.53) 



E 

a,j,k 



Va 

N 



U(d) 



d/i(U) (tr[7r (e a 7 )UaU% k - ti[ix (e^U aU ] ] tx[-K(e a k )UaU^] 



E 

a,j,k 



V a ( Sj k 



N\ d 



U(d) 



• {Q(e«)\Q(et)) (5.54) 
dp(U) tr ^n(e])U] <8> [U ] Ti{e a k )U} -a®a^j 

■ {Q(e«)\Q(e a k )) (5.55) 

since p(e") := u a tr[7r(e")p] = v a tv[ir(e°i)Uo-W] and J JJ , d .dfJL(U)U(7W = I/d. The remaining 
integral is the content of Lemma [5.31 and since tr(T • a ® a) = tr(cr 2 ), Eq. (15. 55ft reduces to 

d " £ « a - i) (Q(e«) |Q(e£)) (5.56) 



e ({^^},Q)( a ) 



> 



(d 2 - 1)JV 

d - tr(a 2 ) 
{d 2 - TjN 



a,j,k 



aj'.fc 



(5.57) 
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applying Lemma 15.21 The sum can be simplified: 



a,j,k a j j,k 



(5.58) 



a,j,k 



^^--^M^I)) (5.60) 

a 

(5.61) 



= (Tr^-l) , (5.62) 

using Eq.'s (44) and (42) of Ref. fl, i.e. JF _1 = E a ,j U a|-R(e")) {R{ef)\ and :F|f) = |J), and 
also the fact that T,j P i e< j) = E; 71 "^) = 



We have thus shown that 

,({3?a,Va},Q) 



el „,^ {a) > 1 ('R(^- 1 )-l)(d-tr(a 2 )) , (5.63) 

with equality if and only if Q(e^) = R(el) + _D a , where i? is the canonical dual frame with 
respect to the trace measure r(e") = v a = n a /N, and ^ a v a D a = 0. The remainder of the 
proof now follows from Lemma 17 of Ref. [3], which states that 

Tr^ 1 ) > d(d(d+l) - l) , (5.64) 

with equality if and only if {F(e°j) = v a ir(e°j)} at j is a tight rank-one IC-POVM. □ 

Finally, recalling that p(cr, U) := UaU> for some fixed a G Q(C d ), we define the worst-case 
error in the linear tomographic estimate of p(cr, U) as 

e$f a > Va} > Q \a) := sup e^^>' Q) (p((7, [/)) , (5.65) 
ueu(d) 

again using Eq.'s (I5.10I) . (I5.14I) . (I5.18P and (I5.2ip . The worst-case error is always bounded 
below by the average error, and when the bases form a tight rank-one IC-POVM, the error 
is in fact independent of U [see Eq. f )5.30p ]. We can thus immediately deduce the following 
corollary to Theorem I5.ll 

Corollary 5.4. Let . . . , £$ m -\ C CP' 1 ' 1 be a family of orthonormal bases for C d with 
the property that {F{e°j) = v a Tc(e°j)} a ,j is an IC-POVM, under the association S$ a = {e^jljZl, 
for some choice of the positive constants t> , . . . , t> m -i- Then for any fixed quantum state o G 
Q(C d ), the worst-case error in the linear tomographic estimate of p(cr,U) after N = J2 a n a 
orthogonal measurements, with n a > of those measurements in the basis SS a , satisfies 

e «f«M,Q) ia) > ^±i( rf _tr(a 2 )) , (5.66) 

for all reconstruction OVDs {Q{e°j)} a ,j ■ Furthermore, equality occurs if and only if {F(e®) = 
v a ^(^)} a j is a tight rank-one IC-POVM for the choice v a = n a /N, and, assuming this choice 
for state reconstruction, Q(e") — (d+ l)7r(e") — I + D a , where {D a } a is any set of operators 
satisfying J2 a v a D a = 0. 
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In fact, weighted complex projective 2-designs which are composed of orthonormal bases 
specify the unique class IC-POVMs (describing a series of orthogonal measurements) that 
achieve 

e af^},R) {a) = e (f«^},fl) ((T) = e« a "^> R \p(<T,U)) = ^(d-tr^ 2 )) . (5.67) 

6. CONCLUSION 

In this article we have introduced the problem of constructing weighted 2-designs in CP d_1 
from the union of a family of m orthonormal bases for C d . If the weight remains constant 
across elements of the same basis, then such designs can be interpreted as generalizations 
of complete sets of MUBs, being equivalent whenever m — d+ 1 (Theorem 13.31) . Although 
weighted 2-designs can be constructed from orthonormal bases in all dimensions and for 
all sufficiently large m > d+ 1 (Corollary 13.21 and Theorem 13.31) . the task remains to find 
examples with m as close as possible to the lower bound. To this end, we have presented 
explicit constructions of weighted 2-designs from m = kd + 2 bases whenever kd + 1 is a 
prime power, for any positive integer k (Propositions H~31 and |4~41 with Theorem 14.21) . and 
shown that m = 0(d 2 ) bases are always sufficient (Proposition 14.51 with Theorem 14.21) . 
Furthermore, our approach, which is based on highly nonlinear functions on abelian groups, 
sheds new light on the known constructions of complete sets of MUBs. Finally, we have 
shown that the entire class of weighted complex projective 2-designs which are composed of 
orthonormal bases specify the unique optimal choice of bases for quantum state tomography 
by orthogonal measurements (Theorem 15.11 and Corollary 15.41) . 

Although this article was motivated from the practical standpoint of verifying quantum 
mechanical devices for information processing, quantum tomography provides one of the 
most powerful means to explore and test fundamental aspects of quantum theory. Indeed, 
quantum information processors rely so critically on the soundness of this theory that their 
very construction will provide new testament to its validity. 
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